This is the authentication service base class.
There can be 1 Authentication Service for the whole Derby system and/or 1 authentication per database. In a near future, we intend to allow multiple authentication services per system and/or per database.
It should be extended by the specialized authentication services.
IMPORTANT NOTE:
User passwords are hashed using a message digest algorithm if they're stored in the database. They are not hashed if they were defined at the system level.
The passwords can be hashed using two different schemes:
In order to use the configurable hash authentication scheme, the users have
to set the derby.authentication.builtin.algorithm property (on
system level or database level) to the name of an algorithm that's available
in one of the security providers registered on the system. If this property
is not set, or if it's set to NULL or an empty string, the SHA-1
authentication scheme is used.
Which scheme to use is decided when a password is about to be stored in the
database. One database may therefore contain passwords stored using
different schemes. In order to determine which scheme to use when comparing
a user's credentials with those stored in the database, the stored password
is prefixed with an identifier that tells which scheme is being used.
Passwords stored using the SHA-1 authentication scheme are prefixed with
PasswordHasher#ID_PATTERN_SHA1_SCHEME. Passwords that are stored using the
configurable hash authentication scheme are prefixed with
PasswordHasher#ID_PATTERN_CONFIGURABLE_HASH_SCHEME and suffixed with the name of
the message digest algorithm.
| Modifier and Type | Field and Description |
|---|---|
| protected UserAuthenticator | |
| public static final String | AuthenticationTrace
Trace flag to trace authentication operations |
| protected static final int | SECMEC_USRSSBPWD
Userid with Strong password substitute DRDA security mechanism |
| private AccessFactory |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public Serviceable | apply(String
Property key for the property being set key, Serializable proposed new value for the property being set or null if
the property is being dropped. value, Dictionary<K, V> Property set before the change. SettingProperty may read but
must never change p. p)Implements org. Apply a property change. |
| public boolean | authenticate(String
The name of the database databaseName, Properties Connection properties info. userInfo)Implements org. Authenticate a User inside JBMS.T his is an overload method. |
| public void | boot(boolean
True if the database should be created create, Properties Configuration properties properties)Implements org. Start this module. |
| private static Context | |
| private static ContextService | |
| pack-priv Properties | Returns: the database properties, ornull if there is no
access factoryGet all the database properties. |
| public String | |
| private static DataDictionary | Returns: theDataDictionary for the current connectionFind the data dictionary for the current connection. |
| public String | Returns: a property string value.Returns a property if it was set at the database or system level. |
| pack-priv static Object | getServiceModule(final Object serviceModule, final String factoryInterface)
Must be package protected so that user code can't call this entry point. |
| protected String | getServiceName()
Get the name of the database if we are performing authentication at the database level. |
| private static String | getServiceName(final Object serviceModule)
Must be private so that user code can't call this entry point. |
| public String | getSystemCredentialsDatabaseName()
Implements org. Get the name of the credentials database used to authenticate system-wide operations. |
| public String | |
| protected TransactionController | |
| protected String | Returns: hashed user password (digest) as a String object ornull if the plaintext password is nullPlain text user password plainTxtUserPassword)This method hashes a clear user password using a Single Hash algorithm such as SHA-1 (SHA equivalent) (it is a 160 bits digest) The digest is returned as an object string. |
| pack-priv String | Returns: a digest of the user name and password formatted as a string, ornull if password is nullthe user whose password to hash user, String the plain text password password, Dictionary<K, V> database properties props)Hash a password using the default message digest algorithm for this system before it's stored in the database. |
| public void | init(boolean
true if only per-database properties are to be looked at dbOnly, Dictionary<K, V> the complete set of per-database properties. p)Implements org. Initialize the properties for this callback. |
| public Serializable | map(String
Property key for the property being set key, Serializable proposed new value for the property being set or null if
the property is being dropped. value, Dictionary<K, V> Property set before the change. SettingProperty may read but
must never change p. p)Implements org. Map a proposed new value for a property to an official value. |
| protected Long | parsePasswordLifetime(String passwordLifetimeString)
Parse the value of the password lifetime property. |
| protected Double | parsePasswordThreshold(String expirationThresholdString)
Parse the value of the password expiration threshold property. |
| protected final boolean | |
| protected void | |
| public void | |
| protected String | Returns: a substituted password.Strong Password Substitution (USRSSBPWD). |
| private static byte[] | |
| public boolean | validate(String
Property key for the property being set key, Serializable proposed new value for the property being set or null if
the property is being dropped. value, Dictionary<K, V> Property set before the change. SettingProperty may read but
must never change p. p)Implements org. Validate a property change. |
| authenticationScheme | back to summary |
|---|---|
| protected UserAuthenticator authenticationScheme | |
| AuthenticationTrace | back to summary |
|---|---|
| public static final String AuthenticationTrace Trace flag to trace authentication operations | |
| SECMEC_USRSSBPWD | back to summary |
|---|---|
| protected static final int SECMEC_USRSSBPWD Userid with Strong password substitute DRDA security mechanism | |
| store | back to summary |
|---|---|
| private AccessFactory store | |
| AuthenticationServiceBase | back to summary |
|---|---|
| public AuthenticationServiceBase() | |
| apply | back to summary |
|---|---|
| public Serviceable apply(String key, Serializable value, Dictionary<K, V> p) Implements org. Doc from org. Apply a property change. Will only be called after validate has been called and only if validate returned true. If this method is called then the new value is the value to be used, ie. the property is not set in the overriding JVM system set.
| |
| authenticate | back to summary |
|---|---|
| public boolean authenticate(String databaseName, Properties userInfo) throws SQLException Implements org. Authenticate a User inside JBMS.T his is an overload method. We're passed-in a Properties object containing user credentials information (as well as database name if user needs to be validated for a certain database access).
| |
| boot | back to summary |
|---|---|
| public void boot(boolean create, Properties properties) throws StandardException Implements org. Start this module. In this case, nothing needs to be done.
| |
| getContext | back to summary |
|---|---|
| private static Context getContext(final String contextID) Must be private so that user code can't call this entry point. | |
| getContextService | back to summary |
|---|---|
| private static ContextService getContextService() Must be private so that user code can't call this entry point. | |
| getDatabaseProperties | back to summary |
|---|---|
| pack-priv Properties getDatabaseProperties() throws StandardException Get all the database properties.
| |
| getDatabaseProperty | back to summary |
|---|---|
| public String getDatabaseProperty(String key) | |
| getDataDictionary | back to summary |
|---|---|
| private static DataDictionary getDataDictionary() Find the data dictionary for the current connection.
| |
| getProperty | back to summary |
|---|---|
| public String getProperty(String key) Returns a property if it was set at the database or system level. Treated as SERVICE property by default.
| |
| getServiceModule | back to summary |
|---|---|
| pack-priv static Object getServiceModule(final Object serviceModule, final String factoryInterface) Must be package protected so that user code can't call this entry point. | |
| getServiceName | back to summary |
|---|---|
| protected String getServiceName() Get the name of the database if we are performing authentication at the database level. | |
| getServiceName | back to summary |
|---|---|
| private static String getServiceName(final Object serviceModule) Must be private so that user code can't call this entry point. | |
| getSystemCredentialsDatabaseName | back to summary |
|---|---|
| public String getSystemCredentialsDatabaseName() Implements org. Doc from org. Get the name of the credentials database used to authenticate system-wide operations. This returns null for all implementations except NATIVE authentication.
| |
| getSystemProperty | back to summary |
|---|---|
| public String getSystemProperty(String key) | |
| getTransaction | back to summary |
|---|---|
| protected TransactionController getTransaction() throws StandardException Get a transaction for performing authentication at the database level. | |
| hashPasswordSHA1Scheme | back to summary |
|---|---|
| protected String hashPasswordSHA1Scheme(String plainTxtUserPassword) This method hashes a clear user password using a Single Hash algorithm such as SHA-1 (SHA equivalent) (it is a 160 bits digest) The digest is returned as an object string. This method is only used by the SHA-1 authentication scheme. | |
| hashUsingDefaultAlgorithm | back to summary |
|---|---|
| pack-priv String hashUsingDefaultAlgorithm(String user, String password, Dictionary<K, V> props) throws StandardException Hash a password using the default message digest algorithm for this system before it's stored in the database.
If the data dictionary supports the configurable hash authentication
scheme, and the property
| |
| init | back to summary |
|---|---|
| public void init(boolean dbOnly, Dictionary<K, V> p) Implements org. Doc from org. Initialize the properties for this callback. Called when addPropertySetNotification() is called with a non-null transaction controller. This allows code to set read its initial property values at boot time. Code within an init() method should use the 3 argument PropertyUtil method getPropertyFromSet() to obtain a property's value.
| |
| map | back to summary |
|---|---|
| public Serializable map(String key, Serializable value, Dictionary<K, V> p) throws StandardException Implements org. Doc from org. Map a proposed new value for a property to an official value. Will only be called after apply() has been called.
| |
| parsePasswordLifetime | back to summary |
|---|---|
| protected Long parsePasswordLifetime(String passwordLifetimeString) Parse the value of the password lifetime property. Return null if it is bad. | |
| parsePasswordThreshold | back to summary |
|---|---|
| protected Double parsePasswordThreshold(String expirationThresholdString) Parse the value of the password expiration threshold property. Return null if it is bad. | |
| requireAuthentication | back to summary |
|---|---|
| protected final boolean requireAuthentication(Properties properties) | |
| setAuthenticationService | back to summary |
|---|---|
| protected void setAuthenticationService(UserAuthenticator aScheme) | |
| stop | back to summary |
|---|---|
| public void stop() Implements org. Doc from org. Stop the module. The module may be found via a findModule() method until some time after this method returns. Therefore the factory must be prepared to reject requests to it once it has been stopped. In addition other modules may cache a reference to the module and make requests of it after it has been stopped, these requests should be rejected as well. | |
| substitutePassword | back to summary |
|---|---|
| protected String substitutePassword(String userName, String password, Properties info, boolean databaseUser) Strong Password Substitution (USRSSBPWD).
This method generates a password substitute to authenticate a client
which is using a DRDA security mechanism such as SECMEC_USRSSBPWD.
Depending how the user is defined in Derby and if BUILTIN
is used, the stored password can be in clear-text (system level)
or encrypted (hashed - *not decryptable*)) (database level) - If the
user has authenticated at the network level via SECMEC_USRSSBPWD, it
means we're presented with a password substitute and we need to
generate a substitute password coming from the store to compare with
the one passed-in.
The substitution algorithm used is the same as the one used in the
SHA-1 authentication scheme ( Note A lot of this logic could be shared with the DRDA decryption and client encryption managers - This will be done _once_ code sharing along with its rules are defined between the Derby engine, client and network code (PENDING). Substitution algorithm works as follow: PW_TOKEN = SHA-1(PW, ID) The password (PW) and user name (ID) can be of any length greater than or equal to 1 byte. The client generates a 20-byte password substitute (PW_SUB) as follows: PW_SUB = SHA-1(PW_TOKEN, RDr, RDs, ID, PWSEQs) w/ (RDs) as the random client seed and (RDr) as the server one. See PWDSSB - Strong Password Substitution Security Mechanism (DRDA Vol.3 - P.650)
| |
| toHexByte | back to summary |
|---|---|
| private static byte[] toHexByte(String str) Convert a string into a byte array in hex format.
For each character (b) two bytes are generated, the first byte
represents the high nibble (4 bits) in hexadecimal (
The character at
New code is encouraged to use
| |
| validate | back to summary |
|---|---|
| public boolean validate(String key, Serializable value, Dictionary<K, V> p) throws StandardException Implements org. Doc from org. Validate a property change.
| |